Rail Operator website Hacked and Hackers asked to Pay Ransom in Bitcoins

Irsh rail operator website has been compromised and the attackers replaces the original websites files with a ransom note demanding to pay 1 bitcoin with 5 days.

Users who tried reaching the tram operator website last Tuesday saw a message claiming the website has been hacked and the company has taken the website down. Users are advised not to reach the website.

It appears more than 3,226 user records has been compromised in the cyber attack. The records are associated with the users who signed up to a Luas newsletter.

The ransom note displayed as follows

You are hacked
some time ago i wrote that you have serious security holes
you didn't reply
the next time someone talks to you, press the reply button
you must pay 1 bitcoin in 5 days
otherwise I will publish all data and send emails to your users
btc address: 3FsR4CTUmumBJK12Zk8QRwdpPTJEY11aSX

Luas confirmed no financial information has been compromised, and the company to contact the affected users within 24 hours.

Luas announced that website has been compromised and the malicious message added to the homepage of the website. We currently have technicians working on the issue.

The site is being analyzed to identify how the attack occurred and technicians are working to restore the service for the customer. Luas transportation was not affected by the attack.

The Attacker said he reported to tram operator about the security holes in the website, and the attack appears to be a defacement attack.

Luas said that they will update customers via twitter, Facebook, AA Roadwatch and the media if there are any changes to services.

You can follow us on LinkedinTwitterFacebook for daily Cybersecurity updates also you can take the Best Cybersecurity courses online to keep your self-updated.

15,779 Indian Websites Hacked During This Year (Jan – Nov) – CERT-India

3000 Hacked Websites Access comes to Sale in Russian Underground Dark Web Marketplace

Indian Hackers Group Hacked & Encrypt Pakistan Website Files Using KCW Ransomware

Gurubaran

Gurubaran is a co-founder of Cyber Security News and GBHackers On Security. He has 10+ years of experience as a Security Consultant, Editor, and Analyst in cybersecurity, technology, and communications.

Recent Posts

Cisco Nexus Vulnerability Allows Attackers to Inject Malicious Commands

Cisco Systems has issued a critical security advisory for a newly disclosed command injection vulnerability…

56 minutes ago

New Wi-Fi Jamming Attack Can Disable Specific Devices

A newly discovered Wi-Fi jamming technique enables attackers to selectively disconnect individual devices from networks…

1 hour ago

GitLab Vulnerabilities Allow Attackers to Bypass Security and Run Arbitrary Scripts

GitLab has urgently released security updates to address multiple high-severity vulnerabilities in its platform that…

3 hours ago

LibreOffice Flaws Allow Attackers to Run Malicious Files on Windows

A high-severity security vulnerability (CVE-2025-0514) in LibreOffice, the widely used open-source office suite, has been…

3 hours ago

Cisco Nexus Switch Vulnerability Allows Attackers to Cause DoS

Cisco Systems has disclosed a high-severity vulnerability (CVE-2025-20111) in its Nexus 3000 and 9000 Series…

4 hours ago

Silver Fox APT Hackers Target Healthcare Services to Steal Sensitive Data

A sophisticated cyber campaign orchestrated by the Chinese Advanced Persistent Threat (APT) group, Silver Fox,…

13 hours ago